Qexplore Files

Qexplore enables a Qmail server to analyze emails.

Its main features are:

- it can reject viruses using Clam Antivirus (http://www.clamav.net);
- it can check for spam using SpamAssassin (http://spamassassin.apache.org);
- it can block emails with particular attachment extensions during the SMTP communication using Reformime (http://www.courier-mta.org/reformime.html);
- it can "rate-limit" messages that an email address can send in a defined amount of time using an embedded db through SQLite (http://www.sqlite.org).
Unlike other scanners for Qmail, such as Simscan or Qmail-Scanner which are inline scanners, Qexplore is an offline scanner that first write an email to a queue resident on disk, closing the qmail-smtpd communication.
It than (offline) analyzes this email to check for virus and/or spam. This design solves the problem of highly traffic smtp servers in wich a lot of concurrent SMTP connections can deny access of incoming/outgoing emails because the system is busy.

In detail, Qexplore is a C sotware composed of a client and a server component.

The client (qexplorec) is designed to be extremely fast to write incoming emails to a queue resident on disk. The only checks that qexplorec can do before storing an email in this queue are:
- email attachments check: if an attachment with a defined extension is denied, the email will be permanently rejected;
- email sender "rate-limit" check: if a sender has reached the "rate-limit", its email will be temporarily rejected until the time associated to the "rate-limit" will not expire.

The server (qexplored) is a daemon which uses the Linux inotify filesystem notification technology to monitor the email queue written by qexplorec.
When an email has been stored in this queue, qexplored forks a child process which can check for virus/spam (the number of concurrently qexplored's childs can be adjusted to limit the system resources usage). If an email hasn't been blocked by those checks, qexplored sends this mail to qmail-queue.